7.2 Manage Alarms and Rogues (APs and Clients) 300-430 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A wireless administrator has identified a rogue AP that is actively broadcasting a spoofed corporate SSID. The administrator wants to contain the rogue AP, but is concerned about the impact on legitimate clients in the area. What should the administrator consider before enabling containment?

   • AContainment will only affect clients attempting to associate with the rogue AP, so there is no impact on legitimate clients.
   • BContainment will permanently disable the rogue AP, so there is no ongoing impact.
   • CContainment may cause legitimate clients to be deauthenticated if they are in the vicinity of the rogue AP, so it should be used cautiously.
   • DContainment is only effective if the rogue AP is on the same channel as the corporate APs, so it may not work in this case.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company uses Cisco Catalyst Center to manage its wireless infrastructure. The security team has identified a rogue AP that is mimicking the corporate SSID. They want to automatically remediate the threat by containing the rogue AP. What is the recommended approach in Catalyst Center?

   • AManually add the rogue AP's MAC address to the rogue AP list in Catalyst Center and mark it as 'Contained'.
   • BUse Catalyst Center's rogue management to classify the AP as 'Rogue' and then push a containment configuration to the associated WLC.
   • CConfigure the WLC to block the rogue AP's channel to prevent clients from using that channel.
   • DDisable the corporate SSID on all access points until the rogue AP is removed.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network team is using Cisco Catalyst Center to monitor rogues. They notice that a legitimate neighboring business's AP is being reported as a rogue. They want to stop these false positives without disabling rogue detection. What should they do?

   • AEnable rogue containment for that AP to prevent it from being detected.
   • BChange the rogue detection threshold to a higher RSSI value.
   • CDisable rogue detection on the WLCs that see the neighboring AP.
   • DAdd the neighboring AP's MAC address to the trusted rogue list in Cisco Catalyst Center.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which WLC configuration option enables the automatic containment of a rogue AP when it is detected?

   • ARogue classification rule
   • BRogue location algorithm
   • CAuto containment
   • DRogue containment level
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A wireless administrator is investigating a rogue AP detected on the network. The rogue AP is broadcasting an SSID that matches the company's corporate SSID, and clients are associating to it. The administrator wants to prevent clients from connecting to this rogue AP while the security team investigates. The rogue AP is located in a neighboring building that is not owned by the company. What should the administrator do?

   • AAdd the rogue AP's MAC address to the rogue AP list and mark it as 'Friendly' to prevent clients from associating.
   • BConfigure the WLC to block the rogue AP's channel to prevent clients from using that channel.
   • CEnable containment on the rogue AP using the WLC, which will send deauthentication frames to clients attempting to associate.
   • DDisable the corporate SSID on all access points until the rogue AP is removed.
   Reveal Solution Discussion Select an answer first